> On the day that I discovered on the GNU g++ compiler that the vtable
> pointer is always at address [base + 0x00] in any polymorphic object,
> I started to explore.

Note that this is only true for the first polymorphic base class, and
C++ supports multiple inheritance. Each polymorphic base has a
separate vtable pointer.

> if ( p.dynamicCast<QWindow> ) DoSomething()

This is fundamentally impossible because your polyhandle is basically
just a void* to the most derived object, but you have no idea what the
offset of the vtable pointer is. It's only zero when it's the first
polymorphic base. For the same reason, you are not allowed to
dynamic_cast a void* to some derived type.

You still haven't provided a compelling use case for this feature.
Dynamic-casting in a loop is simply an anti-pattern.